How Long Should HACCP Records Be Kept? (By Rule)

Under the main US HACCP regulations, keep records for at least one year if the product is refrigerated or perishable, and at least two years if it's frozen, preserved or shelf-stable. That's the rule for seafood and for meat and poultry, and juice is the same with one twist. If you're a food facility under FDA's Preventive Controls rule, which covers most small processors who aren't in one of those categories, it's two years for everything. The details, the citations and the fine print are below.

The short version

If you'd like one house rule that covers every row in that table, keep everything for three years. That's my suggestion and not a regulation, and the reasoning is further down.

This is general information, not legal advice. Your inspector, your auditor or a food safety consultant who knows your product has the last word. Retail and restaurant HACCP plans fall under state and local food codes, so ask your health department.

Rule by rule

Seafood: 21 CFR 123.9

Records are kept at the processing facility "for at least 1 year after the date they were prepared in the case of refrigerated products and for at least 2 years after the date they were prepared in the case of frozen, preserved, or shelf-stable products."

Records about the adequacy of your equipment or processes, like a scientific study behind a critical limit, stay for at least two years after they stop applying to what you make. If you close for the season, records can move somewhere else reasonably accessible, as long as they come straight back for review when asked. (21 CFR 123.9)

Juice: 21 CFR 120.12

One year for perishable or refrigerated juices. For frozen, preserved or shelf-stable products it's "2 years or the shelf life of the product, whichever is greater." So a shelf-stable juice with a three-year shelf life means three years of records.

Processing records can go to offsite storage after six months, provided you can get them back onsite within 24 hours of a request. (21 CFR 120.12)

Meat and poultry: 9 CFR 417.5

USDA's Food Safety and Inspection Service requires records "for slaughter activities for at least one year; for refrigerated product, for at least one year; for frozen, preserved, or shelf-stable products, for at least two years." Offsite storage is allowed after six months if records can be back onsite within 24 hours of an FSIS employee asking. (9 CFR 417.5)

Everyone else: Preventive Controls, 21 CFR 117.315

This isn't called HACCP, and if you make granola, sauces, baked goods or most other packaged food in a registered facility, it's probably the rule you live under. "All records required by this part must be retained at the plant or facility for at least 2 years after the date they were prepared."

Two details worth knowing. Offsite storage is fine if the records can be retrieved within 24 hours, except the food safety plan itself, which must stay onsite. And the rule says plainly that "electronic records are considered to be onsite if they are accessible from an onsite location." If you can pull it up on a screen in the building, it counts. (21 CFR 117.315)

What makes a record count

Keeping a record for two years doesn't help if the record itself wouldn't stand up. (If the term is new to you, here's what a batch record is and what goes in one.) The rules are consistent about what each entry needs:

• It's made at the time of the thing it records. USDA's wording: "at the time the specific event occurs." A temperature log filled in at the end of the shift from memory isn't a record, and inspectors can tell.
• It has the date and time.
• It's signed or initialed by the person who did the check.
• It identifies the product and the production code, if there is one. That's your lot number, and it's what connects a cooking log to the jars it describes. (If you don't have lot codes yet, start here.)
• For FDA-regulated seafood and juice, it carries the name and location of the processor.

It also has to be readable. If nobody can make out whether that's a 1 or a 7, it's not evidence of anything.

Why I'd keep three years anyway

The regulation sets a floor. A few things push the practical number up.

Shelf life. If your hot sauce is good for two years, a jar made today could be on someone's shelf in 2028. You want its batch record to exist for as long as the jar does, plus some margin. The juice rule builds this in. For everything else it's common sense.

Buyers and auditors. Certification schemes and large customers can ask for longer retention than the regulation does, and their requirement is a condition of the contract. Check what yours say.

Other rules stacked on top. Certified organic operations must keep records for at least five years (7 CFR 205.103; more in organic certification record keeping). FDA's Food Traceability Rule asks for two years for foods on its traceability list (21 CFR 1.1455); FDA has proposed moving that rule's compliance date to July 20, 2028 and says it won't enforce it before then. Your tax records have their own clock.

And storage is cheap. Three years of batch records for a small producer is a couple of binders or a trivially small folder of files. The cost of keeping too much is a shelf. The cost of keeping too little is not being able to answer a question about product that's still out there.

Where this stops working

The retention period is rarely what fails. What fails is finding things. Two years of paper monitoring logs is a few thousand pages, and "show me the cooking records for lot 260921B" turns into an hour with a binder while an inspector waits. A mock recall is a good way to find out how long it really takes you. Paper also has the end-of-shift problem: it can't tell anyone whether an entry was written at 10:14 a.m. or reconstructed at five.

How TaroStack does it

To be clear about the boundary: TaroStack doesn't write your HACCP plan or your food safety plan, and it doesn't make anyone compliant. A person who knows your process does that. What it does is keep the production records that those plans ask for, attached to the batch they belong to.

Batch records in TaroStack can carry your own checklist fields, such as cook temperature, pH, metal detector check, or whatever your plan monitors, with a sign-off, and each entry is stamped with who recorded it and when. The record is tied to the batch's lot code and to the ingredient lots that went into it, so "show me the records for lot 260921B" is a search and not a binder. Everything can be exported whenever you want, so your records are never locked inside the software, and since they're reachable from a screen in your building, they're onsite in the sense the Preventive Controls rule describes.

Lot tracking and recall reports are included in every plan. Batch records with checklists are part of Standard.

Questions people also ask

For how many years must HACCP records be kept?

At least one year for refrigerated or perishable products and at least two years for frozen, preserved or shelf-stable ones, under the US seafood, juice, and meat and poultry HACCP rules. Facilities under FDA's Preventive Controls rule keep required records for at least two years.

Can HACCP records be electronic?

FDA's Preventive Controls rule treats electronic records as onsite if they can be accessed from an onsite location. Whatever the format, a record still needs the date and time, the identity of the person who made it, and to have been made when the event happened. Ask your inspector or auditor if they have format expectations.

Can HACCP records be stored offsite?

Under the juice and the meat and poultry rules, yes, after six months, if you can get them back onsite within 24 hours of a request. Under Preventive Controls, yes with the same 24-hour condition, except that the food safety plan itself stays onsite.

What HACCP records do I need to keep?

The plan and the hazard analysis behind it, monitoring records for each critical control point, corrective actions, verification activities such as calibrations and record reviews, and validation documents. There's a filled-in example of a monitoring form here.